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(57) A fail-safe system (Fig.2) used in integrated 
control of a vehicle includes structural-element control 
portions. Preset priority degrees are given to the struc- 
tural-element control portions, respectively. A manager 
control portion (10) stores one or more substitute pro- 
grams designed to implement functions of ones among 
the structural-element control portions which are neces- 
sary for travel of the vehicle. A downloading device op- 
erates for, when one of the structural-element control 
portions which is necessary for travel of the vehicle fails, 
selecting one from non-failed ones of the structural-el- 



ement control portions as a download destination in ac- 
cordance with the priority degrees and downloading the 
substitute program corresponding to the failed structur- 
al-element control portion into the selected download- 
destinatlon structural-element control portion. The se- 
lected download-destination structural-element control 
portion is lower in priority degree than the failed struc- 
tural-element control portion. The download-destination 
structural-element control portion serves for the failed 
structural-element control portion according to the 
downloaded substitute program. 
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